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1 Executive Summary 


1.1 Background 

The Information Commissioner's Office (ICO) has an established 
corporate planning process whereby the three year rolling plan 
(currently 2014-17) is updated annually. The process starts with a 
Management Board Strategy Day in October. The Plan is then 
developed with a draft Plan (and budget for the first year of the Plan) 
going to the Ministry of Justice by Christmas for consultation. 
Management Board formally review the Plan in January prior to a short 
external consultation. The Plan is then finalised by 1 April. 


For 2015-16, to help provide input from the Heads of Department, the 
ICO's Leadership Group has been more formally involved (for example 
in undertaking SWOT/PESTLE analysis). Alongside this the budget is 
being developed by the newly formed Finance Steering Group which 
will also monitor expenditure against budget. 


Our review has examined how the 2015-18 plan was arrived at, 
including an assessment of the delivery to date of the 2014-17 Plan. The 
review also examined the alignment of the business planning process to 
the financial planning arrangements, including how the Finance Steering 
Group fits within the process and how it is used to drive out the 
preparation, monitoring and governance of the budget. 
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1.2 Scope 
Our review involved an assessment of the following risks: 


e The changes to made to the Corporate and Financial Planning 
process (through the use of the Leadership Group and the Finance 
Steering Group) may not delivery the required outcomes of a more 
robust and inclusive planning process that can effectively challenge 
and prioritise spending in the pursuit of organisation-wide 
objectives. 

e Processes may not be agile enough to deal with changes that arise 
during the year, resulting in challenges not being suitably addressed 
or opportunities being missed. 

e The ICO may not have appropriate mechanisms in place to monitor 
and report on the delivery of its Plan alongside financial 
performance, resulting in an inability to quickly identify and respond 
to poor financial performance or delivery. 


Further details on responsibilities, approach and scope are included in 


Appendix A. 


1.3 Overall assessment 
We have made an overall assessment of our findings as: 


Overall assessment 


We have identified matters which, if resolved, will help management 
fulfil their responsibility to maintain a robust system of internal control. 


Please refer to appendix B for further information regarding our overall 
assessment and audit finding ratings. 
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1.4 Key findings 


Risk / Process 


The Corporate Planning Process - - 1 2 


Development and Management of 


Objectives and Outcomes - - 1 - 
Measuring Performance - 1 - 1 
Total - 1 2 3 


There is one Medium rated finding arising out of our review relating to 
the assessment of activity measures. As part of the Corporate Planning 
process, sets of measures are linked to the activities to enable progress 
to be reported on. Our work identified that, whilst each activity has 
been associated with a measure, those measures are not always SMART 
(Specific, Measurable, Achievable, Relevant and Timely). 


As such, when reviewing performance it is not clear whether 
performance exceeds, meets or falls short of requirements; for example, 
it is reported that on average 29 hours training per member of staff were 
provided during the 2013/14 year, but no target was available for 
comparison. Whilst our fieldwork confirmed that the ICO is on track to 
achieve the objectives set out in the 2014-17 plan, without these clear 
targets, the Green, Amber and Red assessment must be considered 
purely subjective. While not all of the ICO’s objectives can be measured 
in a SMART way, those which can should be. 


Further details of our findings and recommendations are provided in 
Section 2. 
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Areas of control in line with expectations 
There is an established corporate planning process (documented in 
the ICO Planning procedure). The overall business planning process 
is overseen by the Corporate Governance team who have a 
responsibility to set deadlines for the process that match the broad 
timetable, facilitate the drafting of the corporate plan, circulating the 
draft plans for comments and public consultation and publish final 
versions. Ultimately, the Executive team are responsible for 
ensuring that completed contributions for the ICO plan are 
delivered by the required deadlines. 
The Corporate and Financial Planning process has evolved over 
recent years to reflect changes to the ICO in order to align with the 
scale and nature of its operation. This includes the setting up on the 
Finance Steering Group, which has a key role in the Planning 
process. 
The Executive team keep the ICO plan under constant review and 
the three year plan is updated every year by means of a Leadership 
Group Planning Day and a Management Board Strategy Day, from 
which the outputs (for example, SWOT and PESTLE analyses) are 
developed into the initial draft plans. Dependencies introduced from 
other Government Departments are considered by the Executive 
Team and Leadership Group. 
Executive Team and quarterly Management Board meetings take 
place where both financial and corporate progress and performance 
are standing agenda items, discussed and variances addressed. 
Attendance at the Management Board meetings is of an 
appropriately senior level, supporting the Information 
Commissioner and allowing decision making to be effective. 


1.6 Acknowledgement 
We would like to take this opportunity to thank the staff involved for 
their co-operation during this internal audit. 
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2 Detailed Findings 


2.1 The Corporate Planning Process 


al Executive summary 


2. Detailed Findings 
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1. | Improvement | Development of the Corporate Plan 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


As part of our review we examined a selection of other 
Executive Non-Departmental Public Bodies with coherent 
corporate plans (the Pension's Regulator, NICE and the 
Environment Agency) to understand on how they presented 
their strategies in comparison to the ICO's. 


The ICO faces a great deal of challenge in the coming years 
(reducing grant in aid, uncertainty over the EU data protection 
regulation, the Triennial Review, and a new Government). 
Whilst a large amount of information on horizon scanning, the 
needs and requirements of the general public and 
organisations and executive knowledge is incorporated into 
the ICO's Plan, in comparison to these other bodies, it is not 
clear how it has been factored into developing the future 
strategy. 


There is a risk that without clear enunciation on 'Who we are’, 
‘Where we want to be’ and 'What.are the challenges that face 
the ICO getting there’ that the Corporate Plan justifies actions 
already under way rather than drives forward delivery and 
change. 


The Corporate Plan should be reviewed and 
consideration be given to updating the format 
and contents. For example; 


Foreword - History of the.ICO 

Executive Summary - Horizon scanning, 
issues and)risks and what stakeholders 
have \been found to want from the ICO 
The ICO's Regulatory Approach and 
enforcement 

The three-year strategic plan = the ten 
information outcomes and how they map 
to the six Corporate Objectives, detail on 
how the six Objectives will be achieved 
and measured. 


Other areas that should also be considered for 
inclusion are; 


Funding, -how the ICO is funded and how 
those funds are apportioned 

Governance structure - description of a 
Corporation Sole and how the 
management boards support the IC. 


Agreedaction: To be cleared in part. 


Details of the ICO’s regulatory approach, history, 
finances and governance structure are detailed 
elsewhere on the ICO website and it is felt that 
including this information in the ICO Plan risks 
duplication. The Commissioner’s foreword to the 
Plan also provides context and as such covers 
issues such as horizon scanning, risks and 
stakeholder views where relevant. So whilst not 
all of the information suggested is included in 
the Plan it is readily available on the website. 


The ten strategic outcomes detailed in the Plan 
are taken from the Information Rights Strategy 
and map across to the six corporate objectives. 
(see action 4 below). In terms of the six 
corporate objectives the actions detailed in the 
plan should demonstrate how the objectives are 
to be met. The final version of the ICO Plan 
2015-2018 will be checked to ensure that 
these points are clear. 


Date Effective: 31 March 2015 


Owner: Peter Bloomfield, Corporate Governance 
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aly Executive summary 
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2. Outputs from Management Strategy Meetings 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


The three year plan is updated every year by means of a 
Leadership Group Planning Day and a Management Board 
Strategy Day, the outputs of which are used to form the 
basis for the detailed ‘How to’ actions. 


As part of our fieldwork, we reviewed the outputs from the 
Leadership Planning day on 9/9/14 and the Management 
Board strategy day on 7/10/14. 


From these outputs, we were unable to ascertain whether all 
Management Board comments from the meeting were 
transferred through to the 2015-18 plan, as a formal set of 
minutes/outputs was not produced. However, our review of 
the minutes from the Leadership Planning Group noted that 
all comments related to the Corporate Objectives transferred 
over to the plan with one exception (regarding the ICO's 
accommodation). 


Key outputs from both the Leadership Group 
Planning Day and Management Board Strategy 
Day should be formally documented. Prior.to the 
release of the first draft of the Corporate Plan, 
these key points should be reconciled to the ICO 
corporate outcomes, objectives and activities to 
ensure that they have been included (or 
excluded with an appropriate rationale). 


Issues, challenges or objectives,related. to the 
changes in Accommodation strategy driven by 
the need to re-negotiate the ICO 
accommodation contract during 2015 should be 
reviewed and if necessary, included in the 2015- 
18 ICO Plan, 


Agreed action: Cleared. 


The Leadership Planning Day and the 
Management Board Strategy Day are not 
formally minuted but notes are taken of the 
outputs and are used to inform the development 
of the ICO Plan. No electronic note of the 
Management Board meeting was available at 
the time of the audit. One is now available. 


Outputs from these meetings are reconciled 
informally against what goes in the ICO Plan. 
The need for a brief formal exercise has been 
included in the ICO Plan procedure. But it is 
worth noting that the Planning and Strategy days 
provide a steer for the Plan rather than specific 
actions to be included. An assessment of what is 
taken forward and why will therefore always be 
subjective. 


In respect of accommodation the position 
remains unclear. If a decision is made that the 
ICO will move from Wilmslow then any project to 
do so and the cost implications would be 
included in a Corporate Plan and budget. 
However until this is decided (if it is) there is 
nothing concrete to include in the ICO Plan. 


Date Effective: 4 February 2015 


Owner: Peter Bloomfield, Corporate Governance 
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al Executive summary 


2. Detailed Findings 
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3. Improvement | Integration of Financial and Operational Planning 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


The ICO's planning process sets out the timetable, process 
and roles and responsibilities for the development of detailed 
actions that support the six overall corporate objectives for 
the following three years. Revised in July 2014, the process 
covers areas for consideration (Risk and Dependencies), the 
need for regular reporting and plan distribution, but currently 
does not include the budgetary development process 
undertaken by the Financial Steering Group. 


By not integrating the budget setting process into the 
planning process, there is a risk that the plans that the ICO 
develops may not clearly align with the financial resources 
that are required to realistically deliver the plans. 


Integrating budgeting into business planning supports the 
formulation of realistic goals and objectives. This enables 
decisions regarding the strategy to be influenced by the 
resources that are available to deliver it, as well as 
identifying areas where additional funding may be required. 
This also promotes better understanding among managers 
of how they should deliver their activities in accordance with 
the budget. 


Developing both Corporate objectives (that 
support the Strategic Aims) and annual budgets 
in parallel enables financial constraints or 
objectives that do notmake use of finances in 
the most effective manner to be identified and 
changes made during, drafting. 


The ICO planning process should integrate the 
timetable for budgetary development and 
submission into the development of the 
Corporate Plan and include financial 
issues/considerations into the dependencies 
listed in the,Planning,Process documentation. 
Both timetables should take into account the 
need for both management and external review 
by the Ministry of Justice and ensure that 
sufficient time is built in to them for this to take 
place. 


Agreed action: Cleared. 


The time table for development of the budget 
has been included in the ICO Planning Process. 


Date Effective: 4 February 2015 


Owner: Peter Bloomfield, Corporate Governance 
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2.2 


Development and Management of Objectives and Outcomes 


al Executive summary 


2. Detailed Findings 


Appendices 


Strategic Outcomes 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


The ICO's Information Rights Strategy, published in 
December 2011, sets out its goal, mission and vision and, as 
well as detailing in more depth how the organisation sets 
about information rights work, lists ten detailed strategic 
outcomes. 


In reviewing the 2015-18 Corporate Plan, there are three 
main findings relating to these strategic outcomes; 


e Despite a large number of challenges and changes in 
the external environment in which the ICO exists 
(including high profile data losses, the publication of the 
Leveson Report and its associated recommendations, 
new and developing legislation in the areas of Freedom 
of Information, Data Protection, Surveillance, etc.) they 
have remained unchanged since 2011. 

e The strategic outcomes are not referenced in the Annual 
Report and achievement against them is not formally 
reported. 

e They are not formally linked in any document'to.the six 
Corporate Objectives that form the basis of the detailed 
business plans. 


The ICO should review its Information Rights 
Strategy to confirm that the ten, Strategic 
Outcomes remain relevant and aligned to 
environment in which it operates,in 2015 and 
beyond. 


The ICO should also formally map the Strategic 
Outcomes to its Corporate Objectives to provide 
clarity as to how delivery of the Corporate 
Objectives wilhsupport the delivery.of the 
Strategy. 


Consideration of the current relevance of the 
outcomes shouldvalso be included in the 
Leadership Planning Day and Management 
Strategy Day agendas. 


Agreed action: Cleared in respect of the 
mapping of the Strategic Outcomes against the 
Corporate Objectives. 


TheInformation Rights Strategy has not been 
reviewed since 2011, and whilst it is not felt to 
be substantially out of date it ought to be 
reviewed at some stage. However the ICO will 
have a new Deputy Commissioner for Data 
Protection and a new Commissioner in Summer 
2016 and (importantly) should know more about 
the impact of the new EU data protection 
regulation (possibly by early 2016). All three of 
these factors mean that the strategy will not be 
reviewed until late 2016 at the earliest. 


The Strategic Outcomes have been mapped 
against the Corporate Objectives with the results 
being incorporated into the ICO Planning 
Procedure. As such the relevance of the 
Strategic Outcomes and the Corporate 
Objectives will be reviewed annually as part of 
the planning process. 


Date Effective: 4 February 2015 in respect of the 
mapping. The end of 2016 in respect of the 
Information Rights Strategy review. 


Owner: David Smith, Deputy Commissioner (iro 
the Information Rights Strategy. 
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2.3 Measuring Performance 


al Executive summary 


2. Detailed Findings 


Appendices 


5. | Medium | Development of SMART Objectives 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


As part of the Corporate Planning process, sets of measures 
are linked to the activities to enable progress to be reported 
on. 


Our work identified that, whilst each activity has been 
associated with a measure, those measures are not always 
SMART (that is Specific, Measurable, Attainable, Relevant 
and Time-bonded). Of the 22 measures reviewed from the 
2015-18 Corporate Plan: 


e one was not considered to be Specific (with the 
measures not supporting the objective), 

e 12 could not be easily quantified using the metrics that 
were provided (and therefore the attainability of the 
objective could not be ascertained) and 

e the draft version reviewed did not yet have management 
ownership assigned. 


Associated to this finding, when reviewing the resultSin the 
Quarterly or Annual Report, it is not clear whether 
performance exceeds, meets or falls short of requirements 
(e.g. it is reported that on average 29 hours training per 
member of staff were provided during the)2013/14 year, but 
no target is available for comparison). 


Whilst our fieldwork therefore confirmed that the|CO is 
monitoring how it considers it is achieving the objectives set 
out in the 2014-17 plan, without clear targets that measure 
the impact that the ICO is having on each of its Strategic 
Outcomes, the Green, Amber and Red assessment must be 
considered purely subjective. 


As part of the Corporate Planning process when 
developing the measures that support objective 
delivery, attention must be givensto; 


e Making each of them. SMART; 

e Assigning a management owner to each; 
and 

e Ensuring that each has a target that can be 
clearly reported against. 


When reporting against these measures on a 
quarterly basis} itwould be beneficial (and make 
reporting clearer), if each achievement of each 
corporate objective was summarised and rated 
on a'one page’ document with further detail 
provided in a supporting section or Appendix. 


Agreed action: Cleared 


The ICO Planning Procedure already states that 
measures should be as SMART as possible. It 
does have to be recognised however that not all 
of the measures can be SMART and reporting 
against some will be subjective. 


ET responsibility is assigned for each action in 
the ICO Plan for reporting purposes; this is not 
included in the published plan. The assigning of 
responsibilities against actions will be completed 
shortly. 


Date Effective:31 March 2015 


Owner: Peter Bloomfield Corporate Governance 
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al Executive summary 


2. Detailed Findings 


Appendices 


Finding and Implication 


Proposed action 


Agreed action (Date / Ownership) 


In reviewing the Corporate Planning process, we also 
considered the process by which objective achievement is 
formally reported on a quarterly and annual basis through 
Operational and Financial reports presented to the 
Leadership and Management Boards. 


It was noted that the number of reported cases closed as 
part of objective 3.1 was reported incorrectly (608 cases 
were reported as closed as opposed to the 3,608 cases that 
were actually closed due to a typographical error). 


This may be linked to the fact that data is presented using a 
large number of graphs aligned to the individual areas’ 
objectives (e.g. a total of 55 tables and graphs across 
Enforcement, Advice, Caseload, PECR, DP and FOI), but 
with little accompanying commentary. It is noted, however, 
that the commentary that was provided in the sample reports 
that we reviewed was insightful and provides an effective 
overview of performance. 


As part of formal reporting procedures, to enable 
clear communication of information to 
stakeholders; 


e The data provided'to the Management and 
Leadership Boards should be reviewed and 
streamlined (reducing the number of graphs 
and tables from 55) 

e Anexecutive summary commentary, that 
clearly identifies trends, issues and results 
thatare aligned with the delivery of the 
ICO's strategic outcomes should be added 
to each areain the operational MI. 


Agreed action: Reporting to Management Board 
had evolved over time and will continue to do so 
given feedback from members, changes to 
operational procedures and as ideas about what 
is important change. Balanced scorecards have 
also been tried previously as a form of executive 
summary for Management Board papers but 
with little success. The Commissioner's top ten 
along with oral commentary on individual reports 
currently provides the executive summary. 


Given this, no specific action will be taken but 
the recommendation is noted and is helpful in 
highlighting possible ways forward. 


Date Effective: NA 


Owner: Christopher Graham 
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A Internal audit approach 


Approach 

Our role as internal auditor to a Public Body is to provide an independent 
and objective opinion to the Accounting Officer on risk management, 
control and governance processes, by measuring and evaluating their 
effectiveness in achieving the organisation's agreed strategic objectives. 


Our audit was carried out in accordance with the guidance contained 
within the Government’s Internal Audit Standards (2013) and the Auditing 
Practices Board’s “Guidance for Internal Auditors’. We also had regard to 
the Institute of Internal Auditors’ guidance on risk based internal auditing 
(2005). In addition, we comply in all material respects with other 
Government guidance applicable to Public Bodies and have had regard to 
the HM Treasury guidelines on effective risk management (the ‘Orange 
Book’). 


As part of our 2014-15 Audit Plan, we agreed with the Audit Committee 
and management that we should carry out a review of the ICO's corporate 
and financial planning process, looking at how the 2015-18 plan was 
arrived at, including an assessment of the delivery to date of the 2014-17 
plan. 


Our aim in completing this audit was to ensure that the ICO has a robust 
business planning process in place that is aligned to financial planning and 
appropriate arrangements in place to identify and report on business and 
financial objectives. 


We achieved our audit objectives by: 


1. Executive summary 
2. Detailed Findings 


Appendices 


e meeting with key staff to gain an understanding of the arrangements to 
ensure the 2015-18 plan and 2015-16 budgets were arrived at and how 
the assessment of delivery of the 2104-17 plan is reported; 

e identifying the key risks to these arrangements and evaluating the 
management controls that mitigate these risks; and 

e reviewing key documents that support the above processes. 


The findings and conclusions from this review will support our annual 
opinion to the Audit Committee on the adequacy and effectiveness of 
internal control arrangements. 


Responsibilities 

The Information Commissioner acts through his Board of Management 
and the Information Commissioner's Office ("ICO") discharges his 
obligations. Therefore references to the Information Commissioner and 
the ICO in this report relate to one and the same party. 


It is the responsibility of the Information Commissioner to ensure that the 
ICO has adequate and effective risk management, control and governance 
processes. 


HM Treasury's Corporate Governance in Central Government 
Departments (2011) states that boards of Public Bodies should determine 
the nature and extent of the significant risks it is willing to take in 
achieving its strategic objectives. The Board should therefore maintain 
sound risk management and internal control systems and should establish 
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formal and transparent arrangements for considering how they should 
apply the corporate reporting and risk management and internal control 
principles and for maintaining an appropriate relationship with the 
organisation's auditors. 


Please refer to our letter of engagement for full details of responsibilities 
and other terms and conditions. 


Scope 
Our review involved an assessment of the following risks: 


e The Changes made to the corporate and financial planning process 
may not deliver the required outcomes of a more robust and inclusive 
planning process. 

e Processes may not be agile enough to deal with changes that arise 
during the year. 

e The ICO may not have appropriate mechanisms in place to monitor 
and report on the delivery of its plan alongside financial performance. 


Additional information 


Client staff 
The following staff were consulted as part of this review: 


e Simon Entwistle — Deputy Chief Executive Officer 

e Andrew Hind — Non-Executive Director 

e Heather Dove — Head of Finance 

e Louise Byers — Head of Good Practice 

e Peter Bloomfield — Senior Corporate Governance Manager 


Documents received 
The following documents were received during the course of this audit: 
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e Draft 6a of the ICO Corporate Plan 2015-2018 

e ICO Performance Report for Q2 (2014-2017) 

e The ICO Corporate Planning Process 

e ICO Leadership Group Planning Day Agenda, Strategy Papers and 
Minutes 

e ICO Management Board Strategy Day Agenda and Strategy Papers 

e ICO Management Board packs from July and October 2014 

e ICO Executive Team meeting minutes from November 2014 

e Ministry of Justice Liaison meeting minutes from October 2014 and 
December 2014 

e ICO Strategic Outcomes 

e ICO Finance Steering Group Terms of Reference 

e ICO Finance Steering Group Agenda and Action Points from 
September 2014 to December 2014 

e ICO Annual Report 2013/2014 

e National Audit Office Comments on the ICO Annual Report 
2013/2014 


Locations 
We visited The Information Commissioner's Office, Wilmslow only for 
this review. 
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B Overall assessment and audit issues ratings 


Overall assessment 


Rating Description 


Following agreement of the nature and significance of individual issues with management, in our view this report contains matters which should be 
raised with Senior Management and the Audit Committee at the earliest opportunity. 


Following agreement of the nature and significance of individual issues with management, in our view this report contains matters which require the 
attention of management to resolve and report on progress in line with current follow up processes. 


We have identified matters which, if resolved, will help management fulfil their responsibility to maintain a robust system of internal control. 


Audit issue rating 
Within each report, every audit issue is given a rating. This is summarised in the table below. 


Rating Description Features 


Key control not designed or operating effectively 

Potential for fraud identified 

Non compliance with key procedures / standards 

Non compliance with regulation 

e — Impact is contained within the department and compensating 
controls would detect errors 

e Possibility for fraud exists 

e Control failures identified but not in key controls 

e Non compliance with procedures / standards (but not resulting in key 

control failure) 

Minor control weakness 

Minor non compliance with procedures / standards 

Information for department management 

Control operating but not necessarily in accordance with best 

practice 


Findings that are fundamental to the management of risk in the business 
area, representing a weakness in control that requires the immediate 
attention of management 


Important findings that are to be resolved by line management. 


Findings that identify non-compliance with established procedures. 


Items requiring no action but which may be of interest to management or 
best practice advice 
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